« Volver al listado

CVE-2026-97974

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()

syzbot reported a null-ptr-deref in __ip6_del_rt_siblings() [0].

The stack trace hinted towards a null dereference of rt->fib6_node when fn->leaf is accessed in __ip6_del_rt_siblings(). With RTNL_FLAG_DOIT_UNLOCKED set, inet6_rtm_delroute() operations run concurrently without acquiring the RTNL lock. In ip6_route_del(), the route lookup happens under rcu_read_lock() without acquiring table->tb6_lock.

Between ip6_route_del() looking up the route and __ip6_del_rt_siblings() acquiring table->tb6_lock, another thread can modify the routing table.

Leer descripción completaMostrar menos

For example, when an ECMP route is replaced via RTM_NEWROUTE with NLM_F_REPLACE, fib6_add_rt2node() unlinks all old siblings and sets iter->fib6_node = NULL. A reproducer was found that triggers this [1].

Add a check to ensure rt->fib6_node is non-null before accessing it.

[1] https://gist.github.com/NamanGulati/0766a1159b6ca61928faaf87425ff899

Detalles técnicos trazas, registros y código del informe original
[0]
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
RIP: 0010:__ip6_del_rt_siblings+0x31e/0x7c0 net/ipv6/route.c:4056
Call Trace:
 <TASK>
 ip6_route_del+0x1054/0x1110 net/ipv6/route.c:4232
 inet6_rtm_delroute+0x5d7/0x6d0 net/ipv6/route.c:5669
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
 __sock_sendmsg net/socket.c:815 [inline]
 ____sys_sendmsg+0x565/0x870 net/socket.c:2713
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767
 __sys_sendmsg net/socket.c:2799 [inline]
 __do_sys_sendmsg net/socket.c:2804 [inline]
 __se_sys_sendmsg net/socket.c:2802 [inline]
 __x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2802
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-97974",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "bd11ff421d36abdb585b9104fa70057bf01b3110",
              "lessThan": "e7ff91f19c1aae039a4257fa86fe849afe185291",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bd11ff421d36abdb585b9104fa70057bf01b3110",
              "lessThan": "1155234c2227cf36072a43e1e09119472ade7ca7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bd11ff421d36abdb585b9104fa70057bf01b3110",
              "lessThan": "cdca92eddc025fdb90071be97738f7d55a65f8dd",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:25.310",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1155234c2227cf36072a43e1e09119472ade7ca7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cdca92eddc025fdb90071be97738f7d55a65f8dd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e7ff91f19c1aae039a4257fa86fe849afe185291",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()\n\nsyzbot reported a null-ptr-deref in __ip6_del_rt_siblings() [0].\n\nThe stack trace hinted towards a null dereference of rt->fib6_node when\nfn->leaf is accessed in __ip6_del_rt_siblings(). With\nRTNL_FLAG_DOIT_UNLOCKED set, inet6_rtm_delroute() operations run\nconcurrently without acquiring the RTNL lock. In ip6_route_del(), the\nroute lookup happens under rcu_read_lock() without acquiring\ntable->tb6_lock.\n\nBetween ip6_route_del() looking up the route and __ip6_del_rt_siblings()\nacquiring table->tb6_lock, another thread can modify the routing table.\nFor example, when an ECMP route is replaced via RTM_NEWROUTE with\nNLM_F_REPLACE, fib6_add_rt2node() unlinks all old siblings and sets\niter->fib6_node = NULL. A reproducer was found that triggers this [1].\n\nAdd a check to ensure rt->fib6_node is non-null before accessing it.\n\n[0]\nKASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]\nRIP: 0010:__ip6_del_rt_siblings+0x31e/0x7c0 net/ipv6/route.c:4056\nCall Trace:\n <TASK>\n ip6_route_del+0x1054/0x1110 net/ipv6/route.c:4232\n inet6_rtm_delroute+0x5d7/0x6d0 net/ipv6/route.c:5669\n rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132\n netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556\n netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345\n netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900\n sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800\n __sock_sendmsg net/socket.c:815 [inline]\n ____sys_sendmsg+0x565/0x870 net/socket.c:2713\n ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767\n __sys_sendmsg net/socket.c:2799 [inline]\n __do_sys_sendmsg net/socket.c:2804 [inline]\n __se_sys_sendmsg net/socket.c:2802 [inline]\n __x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2802\n do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]\n do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\n[1] https://gist.github.com/NamanGulati/0766a1159b6ca61928faaf87425ff899"
    }
  ],
  "lastModified": "2026-09-25T11:17:25.310",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}